Networks

Ask something
Question Locked

Lan to Lan VPN

0 helpful
4 replies

by jmarsh

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a question about the functionality of site to site vpn. I am trying to connect a remote office to a local lan that has a domain server, email server, etc., etc. I am in the process of establishing a site to site (lan to lan)vpn solution between two cisco routers. When the link is up will users be able to log directly in to the Lan and access local resources, shared drives, etc. or will they then have to log on remotely through terminal services(Windows 2003 based)?

Thanks.

4 replies

by netman1958

Once you have the vpn established users will be able to logon to the domain and email etc. If you have an AD you need to be sure the remote computers are configured for the correct DNS server so they can locate the SRV record. If it is Windows NT you will need to be sure the routers forward the NetBios traffic.

There is a rule that says "don't span the WAN" and that you should have at least 1 domain server at each site however I have successfully done it like you are describing.

Another thing, if you are using AD, it's a good idea to add the remote site and subnet to your AD.

by dumphrey

you can modify dns to think the remote resource is "local" in the sense that its in the dns tree.

Email should work just fine if you have a policy for both domains, if they are all one domain, then single sign on will authenticate them across the vpn.

I would not recommend using a remote DC for authentication. It can work, but its slow and prone to some weird errors.

We have 2 domains at 2 locations with a permanent vpn between 2 pix. I can directly log on to a remote server or workstation, and at the other site, they can just open outlook to access email services here. NOTE: Exchange only resloves SHORT dns names such as serverA or serverB in regards to domain services.. It assumes all names are local. So if you have 2 domains, A and B, at two sites. The server is located in DomainA. You will need to add an A record to the DomainA DNS pointing to the domainB domain controller, tricking DNS into thinking its a local machine, even though its a different subnet address. Also do the same, but in reverse for DomainB to domainA.
Did that make sense?

by justinshattuck

Although I am not willing to begin stripping my clothing off; you are pretty dead on with answering your own question.

Essentially it is wise to expand the tree of your ads/ environment to the new lan and span. However, if the hardware is unavailable and you just don't have the resources to span the environment your method will function fine.

You might consider adding this to your budget though, in time the load could become a little overwhelming.

This discussion is closed to new replies.